In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix signed integer overflow in __ip6_append_data
Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t.
UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19 2147479552 + 8567 cannot be represented in type 'int' CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x214/0x230 show_stack+0x30/0x78 dump_stack_lvl+0xf8/0x118 dump_stack+0x18/0x30 ubsan_epilogue+0x18/0x60 handle_overflow+0xd0/0xf0 __ubsan_handle_add_overflow+0x34/0x44 __ip6_append_data.isra.48+0x1598/0x1688 ip6_append_data+0x128/0x260 udpv6_sendmsg+0x680/0xdd0 inet6_sendmsg+0x54/0x90 sock_sendmsg+0x70/0x88 ____sys_sendmsg+0xe8/0x368 ___sys_sendmsg+0x98/0xe0 __sys_sendmmsg+0xf4/0x3b8 __arm64_sys_sendmmsg+0x34/0x48 invoke_syscall+0x64/0x160 el0_svc_common.constprop.4+0x124/0x300 do_el0_svc+0x44/0xc8 el0_svc+0x3c/0x1e8 el0t_64_sync_handler+0x88/0xb0 el0t_64_sync+0x16c/0x170
Changes since v1: -Change the variable [length] type to unsigned, as Eric Dumazet suggested. Changes since v2: -Don't change exthdrlen type in ip6_make_skb, as Paolo Abeni suggested. Changes since v3: -Don't change ulen type in udpv6_sendmsg and l2tp_ip6_sendmsg, as Jakub Kicinski suggested.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-livepatch-5.15.180-122.191Upgrade kernel-livepatch-5.10.236-227.928Upgrade python-perf-debuginfoUpgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade bpftoolUpgrade kernelUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-x86_64 | Apr 30, 2025 | Feb 26, 2025 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernelUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perf | Jul 1, 2025 | Feb 26, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2025 |
| Ubuntu | — | Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-awsUpgrade linux-image-5.15.0-1082-kvmUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1086-realtimeUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-gkeUpgrade linux-image-5.15.0-142-lowlatencyUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-kvmUpgrade linux-image-5.15.0-1039-nvidia-tegra-rtUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1085-gcpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-20.04Upgrade linux-image-oracleUpgrade linux-image-azure-cvmUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1085-gcp-fipsUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-5.15.0-1080-raspiUpgrade linux-image-5.15.0-1050-xilinx-zynqmpUpgrade linux-image-realtimeUpgrade linux-image-5.15.0-1083-gkeUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-142-genericUpgrade linux-image-raspi-nolpaeUpgrade linux-image-virtualUpgrade linux-image-5.15.0-142-generic-64kUpgrade linux-image-5.15.0-1039-nvidia-tegraUpgrade linux-image-5.15.0-1079-intel-iot-realtimeUpgrade linux-image-generic-lpaeUpgrade linux-image-azure-fipsUpgrade linux-image-nvidiaUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-gkeopUpgrade linux-image-aws-fipsUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1091-azureUpgrade linux-image-5.15.0-1091-azure-fipsUpgrade linux-image-5.15.0-1078-ibmUpgrade linux-image-5.15.0-142-generic-lpaeUpgrade linux-image-5.15.0-1080-nvidiaUpgrade linux-image-genericUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1028-nvidia-tegra-igxUpgrade linux-image-generic-64kUpgrade linux-image-gcp-fipsUpgrade linux-image-5.15.0-1083-oracleUpgrade linux-image-5.15.0-1028-nvidia-tegra-igx-rtUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-1086-aws-64kUpgrade linux-image-ibmUpgrade linux-image-5.15.0-142-fipsUpgrade linux-image-oem-20.04dUpgrade linux-image-oem-20.04bUpgrade linux-image-5.15.0-1068-gkeopUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-142-lowlatency-64kUpgrade linux-image-5.15.0-1081-intel-iotgUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1080-nvidia-lowlatencyUpgrade linux-image-fipsUpgrade linux-image-azureUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-5.15.0-1086-aws-fipsUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1083-intel-iotgUpgrade linux-image-azure-lts-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-raspiUpgrade linux-image-intelUpgrade linux-image-5.15.0-1086-awsUpgrade linux-image-nvidia-tegra | Jun 20, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 10, 2025 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub